Malicious PDF — malware analysis report

Static analysis result for SHA-256 e52521dc815c0864…

MALICIOUS

PDF

50.3 KB Created: 2021-03-14 03:14:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-25
MD5: 54c8ccd8c65acfa9b3fde668912ffb85 SHA-1: cc6c8d9a504fabc48f9d9a6b12e7e33759609956 SHA-256: e52521dc815c086490c1f48e5ec6d6caa523a5f0748030a6a1c9f50023273534
124 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8547

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fokemale.ru/award?keyword=apowersoft+online+pdf+editor+free PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4391909/normal_5fe7dd6bb2f5b.pdfIn PDF document text
    • http://feziweninepiv.iblogger.org/advanced_ip_scanner_full_version_free.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4501660/normal_600db1e894475.pdfIn PDF document text
    • http://zazeteku.iblogger.org/practical_pharmaceutical_calculations.pdfIn PDF document text
    • https://cdn.sqhk.co/simikimira/hhhegjn/89309630724.pdfIn PDF document text
    • http://xozivupanivos.22web.org/is_macbeth_loyal_to_his_wife.pdfIn PDF document text
    • http://midopan.iblogger.org/29583315220.pdfIn PDF document text
    • http://ladyso.ru/jubinolomozulixafibejkz8h.pdfIn PDF document text
    • http://ruszaimclub.ru/fazekidagumorumusarububofqnitd.pdfIn PDF document text
    • https://cdn.sqhk.co/vasibejovej/ithhihi/help_the_guy_subway_fun_run.pdfIn PDF document text
    • https://s3.amazonaws.com/fidefofudi/8163492552.pdfIn PDF document text
    • https://c6506652-bf5e-4f52-be36-03dbfaede22c.filesusr.com/ugd/f74919_88e0e3742a8c497cb520133cfc8e2d23.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/sifawekujiki/current_affairs_quiz_july_2019_with_answers.pdfIn PDF document text
    • https://s3.amazonaws.com/wujixus/supply_chain_management_5th_edition_chopra.pdfIn PDF document text
    • https://46ebecaa-9490-439b-bba6-ee77f1a6ca93.filesusr.com/ugd/cee8a1_7a2136e1398d42c8a102d6d9aeddbbcb.pdf?index=trueIn PDF document text
    • https://76ed6b59-b034-43ac-b949-e1c08f76e3cb.filesusr.com/ugd/ee6100_90c21457e9e34de08e3ab3c340a13df8.pdf?index=trueIn PDF document text
    • https://128fc002-9ed4-4a8f-9a6b-83b43563a9ed.filesusr.com/ugd/6812d7_1c5acf1cd8da42278cb5d4d3fe4fbd0a.pdf?index=trueIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.